Ueberauth
Monthly
Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.
Authentication bypass by spoofing in the Elixir ueberauth_apple strategy (0.1.0 through 0.6.1) allows full account takeover because the callback id_token's signature is checked against Apple's JWKS but its registered claims are never validated. Remote unauthenticated attackers who obtain any Apple-signed token carrying the victim's sub - an expired token or one issued to a sibling client in the same Apple developer team - can replay it to log in as the victim. No public exploit identified at time of analysis, but the vendor-confirmed fix (0.6.2) and a clear replay path make this a high-priority auth flaw; EPSS and KEV data were not provided.
BEAM atom-table exhaustion in ueberauth Guardian 2.0.0-2.4.0 allows denial of service by crashing the entire Erlang/Elixir node and all co-hosted services. The Guardian.Permissions module's encode_permissions!/1 function, installed on every module that invokes 'use Guardian.Permissions', unconditionally calls String.to_atom/1 on every key of a caller-supplied map before any validation. Because the integer-value clause of do_encode_permissions!/2 short-circuits to encoding without validating keys against the configured permission set, an attacker who can supply a permissions map with novel keys - for example via a request body fed into token issuance - permanently consumes BEAM atom-table slots at a rate bounded only by available request throughput. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch (2.4.1) is available.
Guardian's AtomEncoding permission encoder (versions 2.0.0-2.4.1) crashes the BEAM runtime by converting attacker-supplied binary strings directly to permanent atoms via String.to_atom/1, completely bypassing the application's permission allow-list. The BEAM atom table is fixed at approximately 1,048,576 non-garbage-collected entries; exhausting it raises a system_limit error that terminates the entire Erlang node and every application co-hosted on it. This path is only reachable when AtomEncoding is explicitly opted into; no CISA KEV listing or public exploit exists, but the attack is trivially automatable against any network endpoint that routes external permission scope values through encode/3.
Unbounded atom creation in Guardian.Plug.Keys allows any attacker who can route arbitrary string values through Guardian's key derivation functions to permanently exhaust the BEAM virtual machine's atom table, crashing the entire BEAM node and denying service to every application co-hosted on it. All guardian releases from 0.1.0 through 2.4.0 are affected whenever an application passes attacker-influenced data - a tenant identifier, HTTP header, or similar request value - as the key parameter to Guardian.Plug.current_token/2, current_claims/2, current_resource/2, or directly to Guardian.Plug.Keys functions. No public exploit code has been identified at time of analysis, though the attack mechanism is mechanically trivial given that it requires only a stream of distinct HTTP requests to a single vulnerable endpoint.
Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.
Authentication bypass by spoofing in the Elixir ueberauth_apple strategy (0.1.0 through 0.6.1) allows full account takeover because the callback id_token's signature is checked against Apple's JWKS but its registered claims are never validated. Remote unauthenticated attackers who obtain any Apple-signed token carrying the victim's sub - an expired token or one issued to a sibling client in the same Apple developer team - can replay it to log in as the victim. No public exploit identified at time of analysis, but the vendor-confirmed fix (0.6.2) and a clear replay path make this a high-priority auth flaw; EPSS and KEV data were not provided.
BEAM atom-table exhaustion in ueberauth Guardian 2.0.0-2.4.0 allows denial of service by crashing the entire Erlang/Elixir node and all co-hosted services. The Guardian.Permissions module's encode_permissions!/1 function, installed on every module that invokes 'use Guardian.Permissions', unconditionally calls String.to_atom/1 on every key of a caller-supplied map before any validation. Because the integer-value clause of do_encode_permissions!/2 short-circuits to encoding without validating keys against the configured permission set, an attacker who can supply a permissions map with novel keys - for example via a request body fed into token issuance - permanently consumes BEAM atom-table slots at a rate bounded only by available request throughput. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch (2.4.1) is available.
Guardian's AtomEncoding permission encoder (versions 2.0.0-2.4.1) crashes the BEAM runtime by converting attacker-supplied binary strings directly to permanent atoms via String.to_atom/1, completely bypassing the application's permission allow-list. The BEAM atom table is fixed at approximately 1,048,576 non-garbage-collected entries; exhausting it raises a system_limit error that terminates the entire Erlang node and every application co-hosted on it. This path is only reachable when AtomEncoding is explicitly opted into; no CISA KEV listing or public exploit exists, but the attack is trivially automatable against any network endpoint that routes external permission scope values through encode/3.
Unbounded atom creation in Guardian.Plug.Keys allows any attacker who can route arbitrary string values through Guardian's key derivation functions to permanently exhaust the BEAM virtual machine's atom table, crashing the entire BEAM node and denying service to every application co-hosted on it. All guardian releases from 0.1.0 through 2.4.0 are affected whenever an application passes attacker-influenced data - a tenant identifier, HTTP header, or similar request value - as the key parameter to Guardian.Plug.current_token/2, current_claims/2, current_resource/2, or directly to Guardian.Plug.Keys functions. No public exploit code has been identified at time of analysis, though the attack mechanism is mechanically trivial given that it requires only a stream of distinct HTTP requests to a single vulnerable endpoint.